@rsc-kit/core 0.30.9 → 0.30.10

package/dist/vite.d.ts

@@ -491,6 +491,23 @@ export type TypecheckOutcome = {
  * is the message, because that is what the developer would have read.
  */
 export declare function typecheckProject(root: string): TypecheckOutcome;
+/**
+ * The engine's modules that exist for the server, by file under the package
+ * and the entry point an app imports them through.
+ *
+ * Importing one from a file the browser also imports does not fail at runtime:
+ * the module loads, a dynamic import of a Node builtin is left dangling, and
+ * Vite prints that it was "externalized for browser compatibility". The
+ * warning is the only trace of a server module having shipped to every visitor
+ * - `redirect()` reached the dashboard's bundle through a helper file that a
+ * client component and a page both imported. Named here so it is refused.
+ *
+ * Internal files that only a server entry reaches are listed against the entry,
+ * so the message names what the app imported rather than what that imports.
+ */
+export declare const SERVER_ONLY: Record<string, string>;
+/** The entry point a module of this package is reached through, when it is a server-only one. */
+export declare function serverOnlyEntry(id: string, root: string): string | null;
 /**
  * A Nitro runtime plugin, so a rollout stops a server cleanly.
  *

package/dist/vite.js

@@ -17,7 +17,7 @@ import { gzipSync } from "node:zlib";
 import { createHash } from "node:crypto";
 import { createRequire } from "node:module";
 import { spawnSync } from "node:child_process";
-import { basename, dirname, join, relative, resolve } from "node:path";
+import { basename, dirname, isAbsolute, join, relative, resolve } from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import rsc, { getPluginApi } from "@vitejs/plugin-rsc";
 import { loadEnv, parseAst } from "vite";
@@ -6706,6 +6706,103 @@ function typecheckPlugin() {
         },
     };
 }
+/**
+ * The engine's modules that exist for the server, by file under the package
+ * and the entry point an app imports them through.
+ *
+ * Importing one from a file the browser also imports does not fail at runtime:
+ * the module loads, a dynamic import of a Node builtin is left dangling, and
+ * Vite prints that it was "externalized for browser compatibility". The
+ * warning is the only trace of a server module having shipped to every visitor
+ * - `redirect()` reached the dashboard's bundle through a helper file that a
+ * client component and a page both imported. Named here so it is refused.
+ *
+ * Internal files that only a server entry reaches are listed against the entry,
+ * so the message names what the app imported rather than what that imports.
+ */
+export const SERVER_ONLY = {
+    request: "request",
+    redirect: "redirect",
+    revalidate: "revalidate",
+    cache: "cache",
+    "js/section": "section",
+    "js/refreshOn": "section",
+    host: "host",
+    hostCalls: "host-calls",
+    prerender: "prerender",
+    export: "export",
+    files: "files",
+    "build-rsc-vite": "build",
+    runtime: "runtime",
+    embed: "embed",
+    typegen: "typegen",
+    conformance: "conformance",
+    testing: "testing",
+    vite: "vite",
+};
+/** The entry point a module of this package is reached through, when it is a server-only one. */
+export function serverOnlyEntry(id, root) {
+    const file = relative(root, id.split("?")[0]).replace(/\\/g, "/");
+    if (file.startsWith("..") || isAbsolute(file))
+        return null;
+    const key = file.replace(/\.(c|m)?(j|t)sx?$/, "");
+    return SERVER_ONLY[key] ?? null;
+}
+/**
+ * Refuse a server-only module in the browser bundle, with the files that
+ * brought it there.
+ *
+ * Only the client environment: the ssr one renders client components to HTML on
+ * the server and imports the request module legitimately, and the rsc one is
+ * where these belong. In a build it is read off the finished module graph; in
+ * dev, as the browser asks for each module.
+ */
+function serverOnlyInTheBrowser() {
+    const fail = (entry, chain) => {
+        const files = chain.map((file) => relative(projectRoot, file).replace(/\\/g, "/"));
+        const lines = files.map((file, i) => `  ${i === 0 ? "imported by" : "which is imported by"} ${file}`);
+        throw new Error(`[rsc-kit] '${PACKAGE_NAME}/${entry}' is for the server, and ended up in the browser bundle:\n` +
+            lines.join("\n") +
+            "\n\nA file the browser imports must not import it, even to call it only on the server. " +
+            "Move what needs it into a file that only server components import, and keep what a client " +
+            "component needs in another.");
+    };
+    const chainOf = (start, importersOf) => {
+        const chain = [];
+        for (let id = importersOf(start)[0]; id && chain.length < 6; id = importersOf(id)[0]) {
+            if (chain.includes(id))
+                break;
+            chain.push(id.split("?")[0]);
+        }
+        return chain;
+    };
+    return {
+        name: "rsc-kit:server-only",
+        applyToEnvironment: (environment) => environment.name === "client",
+        // In dev, the first request for it. The graph the browser asks for grows as
+        // pages are visited, so this is where a leak shows up there.
+        transform(_code, id) {
+            if (this.environment.mode === "build")
+                return;
+            const entry = serverOnlyEntry(id, packageDir);
+            if (!entry)
+                return;
+            // Only a dev environment has a module graph; a build reads the bundler's.
+            const graph = this.environment.moduleGraph;
+            const importers = (of) => [...(graph?.getModuleById(of)?.importers ?? [])].map((m) => m.id ?? "");
+            fail(entry, chainOf(id, importers));
+        },
+        buildEnd() {
+            if (this.environment.mode !== "build")
+                return;
+            for (const id of this.getModuleIds()) {
+                const entry = serverOnlyEntry(id, packageDir);
+                if (entry)
+                    fail(entry, chainOf(id, (of) => this.getModuleInfo(of)?.importers ?? []));
+            }
+        },
+    };
+}
 /**
  * Which server files import a client library, read off the rsc environment's
  * module graph once it is built. plugin-rsc classifies the client packages
@@ -7737,6 +7834,7 @@ export function rscKit(options = {}) {
         stableComponentNames(),
         typecheckPlugin(),
         clientImportsAudit(),
+        serverOnlyInTheBrowser(),
         routesPlugin,
     ];
 }